Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 123801b1 authored by Myles Watson's avatar Myles Watson
Browse files

PDL: Exit early when parsing counted vectors 

Guard against decrementing size_t when it is 0.

Adds an extra if to parsing code of the form:
while ((count > 0) &&          <--- Extra check
       (count-- > 0) &&
       (bytes_left_to_parse > 0)) {
}

Bug: 322230000
Test: atest bluetooth_packet_parsing_test
Flag: EXEMPT, no logical change
Change-Id: I2fd976f7ffb20c8d25ebfa18cb532bbb7fe85a11
parent 82e31399

system/gd/packet/parser/fields/vector_field.cc

+1 −0
Original line number Diff line number Diff line
@@ -119,6 +119,7 @@ void VectorField::GenExtractor(std::ostream& s, int num_leading_bits, bool for_s 
  }

  s << "while (";

  if (size_field_ != nullptr && size_field_->GetFieldType() == CountField::kFieldType) {

    s << "(" << element_field_->GetName() << "_count > 0) && ";

    s << "(" << element_field_->GetName() << "_count-- > 0) && ";

  }

  if (!element_size_.empty()) {

system/gd/packet/parser/test/test_packets.pdl

+20 −0
Original line number Diff line number Diff line
@@ -135,11 +135,24 @@ packet SizedArrayEnum { 
  enum_array : ForArrays[],

}



test SizedArrayEnum {

  "\x00\x00",

  "\x02\x00\x01\x02",

  "\x04\x00\x01\x02\x11\x12",

  "\x06\x00\x01\x02\x11\x12\x21\x22",

}



packet CountArrayEnum {

  _count_(enum_array) : 8,

  enum_array : ForArrays[],

}



test CountArrayEnum {

  "\x01\x01\x02",

  "\x02\x01\x02\x11\x12",

  "\x03\x01\x02\x11\x12\x21\x22",

}



packet SizedArrayCustom {

  _size_(six_bytes_array) : 8,

  an_extra_byte : 8,
@@ -197,6 +210,13 @@ packet VectorOfStruct { 
  array : TwoRelatedNumbers[],

}



test VectorOfStruct {

  "\x00",

  "\x01\x01\x02\x03",

  "\x02\x01\x02\x03\x11\x12\x13",

  "\x03\x01\x02\x03\x11\x12\x13\x21\x22\x23",

}



packet ArrayOfStruct {

  the_count : 8,

  array : TwoRelatedNumbers[4],